From my observation, they didn't steal the coins,, almost everything went back to the imput address as change, they were just sending a message across to inform them of their coins being vulnerable and maybe seeking an offer to fix it the bug for them when contacted. They're good guys. It's something positive as PrivacyG noted.

The input address might belong to the hacker. It was funded by an address that received 3,996 BTC from a Liquid peg-out in this transaction https://mempool.space/tx/8db751a650ae2f12006b7e8c69a75e4df360e8afd6b9e05ae0b9fa6458a7b140

It only sent back 1,000 satoshis to the Liquid federation address along with the OP_RETURN message.

---

Here is more information, posted by the Liquid Network account on X.

https://x.com/Liquid_BTC/status/2096696272447218108

The 2.497 BTC was already in the hacker’s address. The source of that BTC is currently unknown. Given the close timing of when they received it, it could be related to this same incident. They consolidated it with the 3,996 BTC that was drained from the Liquid Network and sent it back to their own address.

I never got into Liquid. Could the hacker/s have pushed a TX that sent everyone's pegged Liquid coins to everyone's respective pkh addresses, aka a massive full refund minus TX fee?

That's an interesting way to demand for a bounty from the network. They will likely have to get in touch with them, and negotiate some form of settlement. Let's just wait and see as the situation evolves.

Oh yea!

Should this pattern be something to raise fears about hackers now using this plot as means to get away with stealing and getting rewarded for it just because they offered to return the stolen funds in disguise of intent to expose a vulnerability and at same time giving a "technical support" to the security situation.
This story reminds me of the 2022 Mango Markets hack which drained about $117 million, and despite how they proposed to return the stolen funds he still got arrested regardless of the cut in deal.

So you prefer something similar to another CC event ?

This same vulnerabilities can be exploited by other groups and lost  forever even if they never spend it.  Nothing related to bouty for now, even if it looks like they are trying to create one out of It but still not as worse as having it stolen completely.

Perhaps next time they would hire attentive people to look at the relevant communication channels. What do they think that someone is going to beg them to write a response to their reports? If they don't listen the normal way, then the entity is going to make them listen the hard way. If the coins end up being returned then they should be happy that this was not another repeat of Coldcard rather than attacking those that found issues with their implementation.

Another justifiable reason for the upset of those that do this kind of exploitation is that often companies tend to underpay, delay payment or outright refuse to acknowledge the bug at all with some kind of nonsense. Extremely critical bugs like this should be rewarded quite nicely, but this is rarely the case. The examples that I write about come from stories of individuals dealing with large tech companies as well.

No. If you are not able to find exploits yourself, don't imagine that it comes from an insider sharing knowledge with an external actor.

Bitcoin had its own fair share of issues, just because they weren't exploited on time in recent history that does not mean that it is significantly different from this. Liquid is great for what it does.